Skimming the technical and legal aspects of BS7799 can give a false sense of security

摘要

BS7799 is an Information Security Management Standard and should not be confused as a technology standard. It is highly regarded within the security management industry, but how many security professionals have asked the question; "Are we getting the most out of our BS7799 programme?" If a thorough Risk Assessment is performed, it can recommend particular technology controls, which are then implemented to mitigate particular risks. The technical controls and the way in which they are implemented, however, can be interpreted differently from person to person. BS7799 provides a framework in which security should be managed, but it is important to explore further the high-level control policies, and in particular those within technical and legal areas.